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Abstract 

The investigation of the terrorist attack is a time-critical task. The 
investigators have a limited time window to diagnose the organizational 
background of the terrorists, to run down and arrest the wire-pullers, 
and to take an action to prevent or eradicate the terrorist attack. The 
intuitive interface to visualize the intelligence data set stimulates the in- 
vestigators' experience and knowledge, and aids them in decision-making 
for an immediately effective action. This paper presents a computational 
method to analyze the intelligence data set on the collective actions of 
the perpetrators of the attack, and to visualize it into the form of a so- 
cial network diagram which predicts the positions where the wire-pullers 
conceals themselves. 

1 Introduction 

Terrorist attacks cause great economic, social and environmental impacts. The 
disaster by the terrorist attacks is different from the emergence arising from 
earthquakes or hurricanes, in that active non-routine responses are always nec- 
essary, and often possible. The investigation of the terrorist attacks and the 
responses are, however, a time-critical task. The investigators have a limited 
time window to diagnose the organizational background of the terrorists, to run 
down and arrest the wire-pullers, and to take an action to prevent or eradicate 
the attack. The arrest of the wire-pullers is more likely to dismantle the terrorist 
organization than that of the perpetrators. This is because a limited number 
of persons can provide the perpetrators with financial supports and elaborate 
plots, while a perpetrator can be replaced by another person easily. 

Let us show an example in the 9/11 terrorist attack in 2001. Mustafa A. 
Al-Hisawi, whose alternate name was Mustafa Al-Hawsawi, was alleged to be 
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a wire-puller, who had acted as a financial manager of Al Qaeda. He had at- 
tempted to help terrorists enter the United States, and provided the hijackers 
of the 4 aircrafts with financial support worth more than 300,000 dollars, ac- 
cording to Wikipedia (free encyclopedia on WWW). Furthermore, Usama bin 
Laden is suspected to be a wire-puller behind Mustafa A. Al-Hisawi and the 
conspirators behind the hijackers. 

This paper presents a computational method to analyze the intelligence data 
set on the collective actions of the perpetrators of the terrorist attack, and to 
visualize it into the form of a social network diagram which predicts the positions 
where the wire-pullers conceals themselves. The intuitive interface between the 
intelligence data set and the investigator through the social network diagram is 
expected to stimulate the investigators' experience and knowledge, and to aid 
them in decision-making for an immediately effective action. Mathematically, 
the objective of the analysis is to solve a node discovery problem in a complex 
network. Two layers are assumed in this problem. The first layer describes the 
latent pattern of the communication among persons, which is the transmission 
of the influence on decision-making. It is modeled by a graph structure, where 
nodes are persons, and links indicate the presence of communication among the 
persons. The structure is assumed not to be observable directly. The second 
layer describes the observable pattern of collective actions of the persons. It 
appears as a result of the communication in the latent layer. Part, or all of 
this pattern is assumed to be observable. To solve the node discovery problem 
means to discover some clues on the covert nodes, which participate in the 
communication in the latent layer, but do not appear in the collective actions 
in the observable layer. 

Related works are reviewed briefly in the section [2l A method to solve 
the node discovery problem is developed in the section [31 The section 2] demon- 
strates an example where the perpetrators and a wire-puller in the 9/11 terrorist 
attack are analyzed. The section [5] concludes this paper. 

2 Related works 

Social network analysis |3J is a study of social structures, which are made of 
nodes (individuals, organizations etc.), which are linked by one or more specific 
types of relationship (transmission of influence, presence of trust etc.). Terrorist 
or criminal organizations have been studied empirically [20| . Factor analysis is 
applied to study email exchange in Enron, which ended in bankruptcy due to the 
institutionalized accounting fraud [llj . The criminal organizations tend to be 
strings of inter-linked small groups that lack a central leader, but to coordinate 
their activities along logistic trails and through bonds of friends. Hypothesis 
can be built by paying attention to remarkable white spots and hard-to-fill po- 
sitions in a network [12]. The conspirators in the 9/11 terrorist organization 
are relevant in reducing the distance between hijackers, and enhancing commu- 
nication efficiently [13]. The 9/11 terrorists' social network is investigated from 
the viewpoint of efficiency and security trade-off [18] . More security-oriented 
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structure arises from longer time-to-task of the terrorists' objectives. The con- 
spirators improve communication efficiency, preserving hijackers' small visibility 
and exposure. 

Research interests have been extending from describing characteristic nature, 
toward modeling and predicting unknown phenomena. A hidden Markov model 
and a Bayesian network are combined to predict the behavior of terrorists |22| . 
A link discovery and node discovery are typical problems in prediction tasks. 
The link discovery predicts the existence of an unknown link between two nodes 
from the information on the known attributes of the nodes and the known links 
[S] . The Markov random network is an undirected graphical model similar to a 
Bayesian network, which is used to learn the dependency between the links which 
share a node [1] , [6] . The link discovery techniques are combined with domain- 
specific heuristics and expertise, and applied to many practical problems. The 
Markov random network is applied to collaborative classification of web pages 
p3] . Prediction of the collaboration between scientists from the published co- 
authorship is studied [T5|. Inference of the friendship between people from 
the information available on their web pages is studied [5]. Missing links in a 
hierarchical network is predicted by estimating the parameters of a dendrogram, 
which generates the observed network structure 0j. The dendrogram is a tree 
diagram used to illustrate the arrangement of the hierarchical clusters. 

On the other hand, the node discovery predicts the existence of an unknown 
node around the known nodes from the information on the collective behavior of 
the network. Related works in the node discovery is, however, limited. Heuristic 
method for node discovery is proposed in [16], [Ej. The method is applied to 
analyze the covert social network foundation behind the terrorism disasters [17] . 
Learning techniques of latent variables can be employed, once the presence of 
a node is known. [5T] studied learning of a structure of a linear latent variable 
graph. [7] studied learning of a structure of a dynamic probabilistic network. 
But, while the accuracy of the heuristic method is limited, these principled ana- 
lytic approaches in learning are not practical to handle real human relationship 
and communication observed in a social network, where much complexity ap- 
pears. The complexity includes bi-directional and cyclic influence among many 
observed and latent nodes. We need an efficient and accurate method to solve 
the node discovery problem. 

3 Method for inference, discovery, and visual- 
ization 

3.1 Intelligence data set 

Imagine a situation where an investigator diagnoses the intelligence data set for 
the run-down of the wire-puller behind the terrorist attack. Figured] illustrates 
the situation. The pattern of the communication among perpetrators and a wire- 
puller in the terrorist organization lies in the latent layer. It is the transmission 
of the influence on decision-making. The pattern governs that of the collective 
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Figure 1: Investigator diagnosing the intelligence data set for the run-down of 
the wire-puller behind the terrorist attack. The communication and influence 
on decision-making among the perpetrators and a wire-puller in the terrorist 
organization governs the pattern of the collective actions (such as attending an 
meeting or event) of the perpetrators who have prepared for the attack. The 
communication and influence are assumed not to be observable directly. Part or 
all of the collective actions are assumed to be observable. The intelligence data 
set consists of the secret agents' records on the collective actions of the perpe- 
trators. The wire-puller does not appear in the intelligence. After link inference 
and node discovery, the intelligence data set is visualized into an intuitively 
understandable social network diagram. 
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actions of the perpetrators who have prepared for the terrorist attack in the 
observable layer. The collective actions are attending an meeting or event, for 
example. 

The intelligence data set consists of the secret agents' records on the col- 
lective actions of the perpetrators. The wire-puller, however, does not appear 
in the intelligence. The wire-puller is referred to by a covert node Ucvt- The 
investigator applies three tools: (1) link inference to infer the communication 
between the perpetrators, (2) node discovery to discover the position of the 
wire-puller, and (3) visualization of the result of the inference and discovery 
into the form of a social network diagram. The social network diagram serves 
as an intuitive interface to understand the intelligence data set. 

Mathematical definition of the intelligence data set is given here. In eq.(IT]), 
Si represents the participants to single communication in the latent layer. It is 
a set of nodes rij . 

= {n,}. (1) 

It is assumed that the individual intelligence data obtained from the observ- 
able layer is the pattern in eq.((T]) minus the covert node ricvt- It is denoted by 
eq.®. 

di = Si\{ncvt}- (2) 

The whole intelligence data set is denoted by D in eq.fS]). The number of 
intelligence data is \d\. 

D = {d^} (0 < i < |d| - 1). (3) 

The intelligence data set D can be expressed by a two dimensional matrix 
of binary variables. The presence, or absence of the node rij in the intelligence 
data di is represented by eq.([3]). The number of node species is given by \n\. 

The intelligence data set is the input to the method for link inference, node 
discovery, and visualization. The nodes in an intelligence data do not necessarily 
form a clique structure, where there are links between every pair of nodes. 
Assuming that they formed a clique would result in a very densely connected 
structure in the latent layer. Such a superficial interpretation of the intelligence 
data set leads to a wrong understanding of the terrorist organization. This is 
why we need a new computational method. The method is described below. 

3.2 Link inference 

The communication in the latent layer is modeled by a graph. Strictly speaking, 
a graph, a diagram, and a map are defined differently. A graph is an abstract 
mathematical entity, which consists of a set whose elements are nodes, and a 
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set of pairs of nodes. A diagram is a 2 dimensional expression of a graph, which 
is the drawing of the web of the hnks interconnecting at the nodes. In a map, 
faces are relevant, which are determined by the links and their intersections. A 
network refers to either a graph, or a diagram. The map is not used in this 
paper. The nodes in the graph represent persons, and the links represent the 
transmission of influence. The links between the nodes which appeared in the 
intelligence data set is inferred with the maximum likelihood estimation (MLE). 
A parametric form is defined to describe the link topology. The probability 
where the influence transmits from an initiating node rij to a responder node ni~ 
is rjk- The influence transmits to multiple responders independently in parallel. 
It is similar to the degree of collaboration probability in trust modeling [IJ. 
Eq.® gives constraints on rjk- 



< rjk < 1, = 1 (0 < J, A: < \n\ ~ 1). (5) 

The quantity fj is the probability where the node nj becomes an initiator. 
The parameters rjk and fj are denoted by r collectively. It is the target to 
estimate from the observation data set. 



r^{rjk}^{f,} {0<^,J <\n\-l). (6) 

The logarithmic likelihood function 5j is defined by eq.©. In statistics, a 
likelihood function is a conditional probability function of the observation given 
the parameters of a statistical model. It plays a key role in statistical inference 
such as Bayes' Law. The probability where D occurs for given r is denoted by 
p{D\r). 

L{r) = \og{p{D\r)). (7) 

The individual observations are assumed to be independent. Eq.([7]) becomes 
eq.®. 

\d\-l \d\-l 

L{r) = log( n pid.,\r)) = log(p(^^l^))- (») 

i=0 i=0 

The quantity in eq.® is the probability where the presence or absence 
of the node Uk as a responder to the stimulating node Uj coincides with the 
observation di. 

rjk if dik — 1 for given i and j 

rjk 

Eq.® is equivalent to eq. pO)) since the value of dik is either or 1. 

fk\ij = dikrjk + (1 - dik){l - rjk). (10) 
The probability p(-D|r) in eq.® is expressed by eq. (fTT|) . 



_ I rjk n Uifc = 1 iui given i anu j , , 

- 1 1 _ r,k otherwise • ^ > 
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n|-l 

pid,\r) = dijfj Yl fk\t. 



(11) 



j=0 < fc < | r! | - 1 



The logarithmic Ukchhood function is expressed by eq. p^ . 



\d\-l \n\-l \n\-l 



L{r) = E "^-^f^ n {1 ~ + - l)r,fe}). 



(12) 



1=0 j=0 fc=0 



The maximal likelihood estimator r is obtained by solving eq. (fT5|) . It rep- 
resents the inferred topology of the network. 



Lagrange multipliers can be used to solve eq. (fT5|) analytically. But, at 
present, computational optimization is suitable to solve a large-scale problem. 
The hill climbing method is a simple incremental optimization technique. Un- 
suitable selection of the initial condition may lead to the sub-optimal solutions. 
Advanced meta-heuristic algorithms such as simulated annealing, or genetic al- 
gorithm [10] may be employed to avoid sub-optimal solutions. It is not within 
the scope of this paper to explore the computational technique to solve cq. (|13p . 
The details of the algorithm implementation are not described here. 

3.3 Node Discovery 

The clues on the covert node in the latent layer are discovered after the topol- 
ogy of the links between the nodes, which appeared in the intelligence data set, 
is inferred with the maximum likelihood estimation (MLE) in 13.21 The degree 
of suspiciousness {s{di)) is assigned to the individual inteUigence data di. It is 
defined as the likeliness where the covert node would appear in the intelligence 
data, if it became overt, or if the wire-puller were observable. The degree of 
suspiciousness is evaluated by ea. p4)) . where g{x) is a monotonically decreas- 
ing function of the variable x. Larger value in eq. (ll4p means more suspicious 
intelligence data. 



Ranking of the intelligence data can be calculated from the value of eq. p4|) . 
The fc-th most suspicious intelligence data is given by ^^.(fe) in eq. (|15[) . The 
degree of suspiciousness of c?cr(j) {s{d„(^j))) is larger than that of (icr(fc) (s(c?g.(fe))) 
for any j < k. 



r — arg max L(r). 



(13) 



s{di) oc g{p{di\r)). 



(14) 



a{k) — arg max s{di) (0 < fc < |d| — 1). 

j <k 



(15) 
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The degree of suspiciousness {s{nj)) can also be assigned to the individual 
nodes rij. More suspicious node is more likely to be the neighbor node of the 
covert node. Or, it is more likely to be the perpetrator who is associated with 
the wire-puller closely. The degree of suspiciousness s{nj) can be evaluated by 
accumulating the degree of suspiciousness of the intelligence data {s{di)), where 
the node appears, as in eg.^TO)). The function w{k) is an appropriate weight 
function. 



EIIo^ B{nj e dk) 
The Boolean function in cq. is defined by eq. pT|) 



«K) « — „, — ■ (16) 



^ _ I 1 if proposition x is True 
\ otherwise ' 

Alternatively, much simpler means to discover the suspicious nodes may be 
taken. The suspicious nodes are the neighbor nodes rinbr, which appear in the 
most suspicious intelligence data (i(j(o)- It is denoted by ea.lflSl). 

{rinbr} e d^(0). (18) 



3.4 Social network visualization 

The output of the link inference and node discovery is drawn as a social network 
diagram, which predicts the position of the covert node Ucvt with the suspicious 
neighbor nodes rinbr- The link topology is relevant in the social network diagram. 
But, the absolute position of the nodes, the distance between the nodes, the 
direction along the vertical and horizontal axes are not relevant. The position 
of the nodes is determined by the employed graph drawing algorithm. For 
example, the spring model [S| is popular. The model converts the strength 
of the relationship across the link between two nodes into Hooke's constant of 
the spring, which is placed between the nodes imaginarily, and calculates the 
equilibrium position of the nodes. 

At first, the social network of the nodes which appeared in the intelligence 
data set is drawn. The communication in the latent layer is present between 
the nodes Uj and n^, if the maximal likelihood estimator fjk is larger than 0. 
The estimator Vjk approaches to either 1 or 0, in most cases. The link is drawn 
if Tjk > fthrj because strong relationship is of interest to the investigator. The 
threshold rthr may be 0.9 or larger. Next, the suspicious nodes rtnbr in eq. p^ 
are added into the social network diagram with the discovered covert node ricvt- 
The identity of the covert node ricvT is not known at this stage of investigation. 
The covert node is, therefore, represented by an unlabeled (unnamed) node. The 
links between the covert node and the suspicious neighbor nodes are drawn. 

The parameter , which is the probability where the node nj becomes an 
initiator of communication, is not visualized into the topology of the social net- 
work diagram. If it is necessary to indicate the value graphically, the largeness 
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Table 1: The 19 perpetrators who are responsible for hijacking the 4 commercial 
flights (number: AAll, AA77, UA93, and UA175) in the 9/11 terrorist attack, 
and appear in a sample intelligence data set. 



Flight 


Hijacker 


AAll 


Abdul A Al-Omari, Mohamed Atta, Satam Suqami, Wail Alshehri, 
Walecd Alshehri 


AA77 


Hani Hanjour, Khalid Al-Mihdhar, Majed Moqed, Nawaf Alhazmi, 
Salern Alhazmi 


UA93 


Ahmed Al-Haznawi, Ahmed Alnami, Saeed Alghamdi, Ziad Jarrah 


UA175 


Ahmed Alghamdi, Fayez Ahmed, Hamza Alghamdi, Marwan Al-Shchhi, 
Mohand Alshehri 



of the value can be encoded into the color, or largeness of the symbol of the 
node. 

4 Visualization of the 9/11 terrorists 

An example of visualizing the intelligence data set is demonstrated. The intelli- 
gence data set is the records on the collective actions of the perpetrators of the 
9/11 terrorist attack in 2001. The 19 perpetrators are listed in Table [1] who are 
responsible for hijacking the 4 commercial flights in the 9/11 terrorist attack 
(number: American Airlines AAll (Boeing 767 from Boston to Los Angeles), 
AA77 (Boeing 757 from Washington to Los Angeles), United Airlines AA175 
(Boeing 767 from Boston to Los Angeles), and UA93 (Boeing 757 from Newark 
to San Francisco)), and appear in a sample intelligence data set. 

The intelligence data set is listed in Table [2l The data set is not real, but is 
generated for the purpose of computer simulation. The intelligence data set is 
the input to the method to generate a social network diagram, which predicts 
the positions where the wire-pullers conceals themselves. The resulting social 
network diagram is shown in Figure [2l It visualizes the inferred links between 
the nodes, and the node discovered from the sample intelligence data set in 
Table [51 The nodes represent the 19 perpetrators. The links represent the 
transmission of influence between the perpetrators in the latent layer. They 
govern the pattern of the collective actions in the observable layer, which were 
recorded in the intelligence data set. The perpetrators in an intelligence data 
do not form a simple clique structure, actually. For example, if the 8 nodes 
in dg formed a clique structure, the nodal degree of the nodes would be 7. 
The actual nodal degree is much smaller than 7. The network is much less 
densely connected than it would be if the perpetrators in a single intelligence 
data formed a clique structure. The method reveals the less densely connected 
topology of the terrorist organization. 
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Table 2: Sample intelligence data set on the perpetrators in Table [TJ which is 
the input to the method (eq. ([3]) in 13. 1[) to generate a social network diagram. 



Data 


Participant to a collective action 


do 


{Abdul A Al-Omari, Fayez Ahmed, Hani Hanjour, Marwan Al-Shchhi, 
Mohamed Atta, Salern Alhazmi, Ziad Jarrah} 


di 


{Abdul A Al-Omari, Hani Hanjour, Marwan Al-Shehhi, Mohamed Atta, 
Nawaf Alhazmi, Ziad Jarrah} 


d2 


{Abdul A Al-Omari, Marwan Al-Shehhi, Mohamed Atta, Waleed Alshehri} 


ds 


{Abdul A Al-Omari, Satam Suqami, Wail Alshehri, Waleed Alshehri} 


C?4 


{Ahmed Alghamdi, Ahmed Al-Haznawi, Ahmed Alnami, Hamza Alghamdi, 
Mohand Alshehri, Nawaf Alhazmi, Saeed Alghamdi} 


d5 


{Ahmed Alghamdi, Hamza Alghamdi} 


de 


{Ahmed Al-Haznawi, Ahmed Alnami, Hamza Alghamdi, Nawaf Alhazmi, 
Saeed Alghamdi} 


dr 


{Ahmed Al-Haznawi, Hamza Alghamdi, Saeed Alghamdi, Ziad Jarrah} 


ds 


{Ahmed Al-Haznawi, Hani Hanjour, Marwan Al-Shehhi, Mohamed Atta, 
Salern Alhazmi, Ziad Jarrah} 


dg 


{Ahmed Alnami, Hamza Alghamdi, Hani Hanjour, Khalid Al-Mihdhar, 
Mohamed Atta, Nawaf Alhazmi, Saeed Alghamdi, Salern Alhazmi} 


dio 


{Ahmed Alnami, Hamza Alghamdi, Nawaf Alhazmi, Saeed Alghamdi} 


dii 


{Fayez Ahmed, Hamza Alghamdi, Mohand Alshehri} 


di2 


{Fayez Ahmed, Marwan Al-Shehhi, Mohamed Atta, Waleed Alshehri} 


di3 


{Fayez Ahmed, Marwan Al-Shehhi, Mohand Alshehri} 


dii 


{Hani Hanjour, Khalid Al-Mihdhar, Majed Moqed, Marwan Al-Shehhi, 
Mohamed Atta, Nawaf Alhazmi, Ziad Jarrah} 


di5 


{Hani Hanjour, Khalid Al-Mihdhar, Nawaf Alhazmi} 


die 


{Hani Hanjour, Majed Moqed} 


dij 


{Marwan Al-Shehhi, Nawaf Alhazmi, Salern Alhazmi, Ziad Jarrah} 


dis 


{Satam Suqami, Wail Alshehri, Waleed Alshehri} 


di9 


{Satam Suqami, Wail Alshehri, Waleed Alshehri} 
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Figure 2: Social network diagram which visuahzes the links between the nodes, 
and the node discovered from the sample intelligence data set in Table [21 The 
nodes represent the 19 perpetrators. The links represent the transmission of 
influence between the perpetrators, which governs the pattern of the collective 
actions which were recorded in the intelligence data set. The discovered node, 
which is not labeled in the figure, indicates the position where the wire-puller 
is most likely to conceal himself. The node has 4 links (red broken lines) to 
Fayez Ahmed, Mohamed Atta, Marwan Al-Shehhi, and Waleed Alshehri. They 
are the keystone neighbors for the run-down and arrest of the wire-puller. The 
wire-puller in the figure turns out to be Mustafa A. Al-Hisawi in [TB] . 
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The discovered node ricvt, which is not labeled (named) in the figure, indi- 
cates the position where the wire-puller is most likely to conceal himself. The 
node has links (red broken lines) to the 4 neighbor nodes: Fayez Ahmed, Mo- 
hamed Atta, Marwan Al-Shehhi, and Waleed Alshehri. The neighbor nodes 
are nnbr G di2, because ^^(o) = ^12 is the most suspicious intelligence data. 
Mohamed Atta and Waleed Alshehri hijacked the flight AAll, which flew into 
the North Tower of the World Trade Center. Mohamed Atta was the leader of 
the hijackers. Waleed Alshehri assisted Mohammed Atta. Fayez Ahmed and 
Marwan Al-Shehhi hijacked the flight UA175, which flew into the South Tower. 
Marwan Al-Shehhi, who trained at a pilot school with Mohammed Atta, flew 
the aircraft. Fayez Ahmed was also a pilot. The wire-puller was a linkage be- 
tween the 2 flights which were used as weapon to the financial landmark of the 
United States. They are the keystone neighbors to investigate to unravel who 
is the wire-puller, or what is behind the terrorist attack. 

The ties between the persons concerned are revealed by [13]. They include 
the 19 perpetrators, conspirators, and suspects. The tie strength is estimated 
by the amount of time together by a pair of terrorists. Those living together, 
attending the same school, or the same training would have strong ties. Those 
traveling together, and participating in meetings together would have ties of 
moderate strength. Finally, those who were recorded as having a financial trans- 
action together, or participating in an occasional meeting would have weak ties. 
Publicly available data is used as such intelligence data set. By comparing with 
the ties in [l3j, the wire-puller in Figure [2] turns out to be Mustafa A. Al-Hisawi. 
He is believed to be a financial manager of Al Qaeda, and to give Fayez Ahmed 
a credit card as a financial support for the attack. 

Remind that this result is for demonstration purpose. The objective is to 
demonstrate how the intuitive visualization can help the investigator diagnose 
the intelligence data set, rather than to uncover the real role of Mustafa A. 
Al-Hisawi, or Usama bin Laden in the 9/11 terrorist attack. 

5 Conclusion 

This paper presented a computational method to analyze the intelligence data 
set on the collective actions of the perpetrators of the terrorist attack, and to vi- 
sualize it into the form of a social network diagram, which predicts the positions 
where the wire-pullers conceals themselves. This will help the investigators, who 
have a limited time window to diagnose the organizational background of the 
terrorists, to run down and arrest the wire-pullers, and to take an action to 
prevent or eradicate the terrorist attack. The intuitive interface to visualize the 
intelligence data set will stimulate the investigators' experience and knowledge, 
and aids them in decision-making for an immediately effective action. 

The important aspect of the presented method is that the diagnosis of the 
investigator illustrated in Figure[T]can be repeated many times. The investigator 
can predict the position of Mustafa A. Al-Hisawi from the intelligence data set 
on the 19 perpetrators. Then, once the wire-puller is identified as Mustafa A. 
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Al-Hisawi, the intelligence data set on Mustafa A. Al-Hisawi should be collected 
and added to the diagnosis. Similarly, the investigator can predict the position 
of the 21st person again from the intelligence data set on the 19 perpetrators 
and Mustafa A. Al-Hisawi. 

The method provides the investigator with the intuitively comprehensible 
direction of potentially fruitful investigation from what is already known toward 
what is not, but can be known. 
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